Radio Logos etc

So what's the point of getting more into the electronics side of things? Well, recently after digging through some folders on my old laptop I ran into a project I worked on last year.  Actually, over a year ago a certain someone (In Reservoir Dogs fashion as to not identify him, let's call him Mr. White, and since I drive a Black G8, I'll be Mr. Black ;) )  handed me a few binary files which were somehow dumps of the radio. After some digging I was able to figure out the file format for one of the files for about 99% and extract a bunch of graphics which I then turned into GIFs (obviously they are NOT in GIF format natively) for your viewing pleasure. In some of the other files I found the font graphics, and some other generic graphics like the 'MUTED' overlay, but this one file has the most fun stuff:

Look familiar? (You will probably have to click on them to see the animation)

Yes indeed - These are the available startup logo's (which are 362x145 natively) for the radio in the Pontiac G8 (& Holden commodores). While a lot of people know what byte to change to select which image on the EEPROM (which IIRC is 2kb) the actual image data obviously is located elsewhere. Mr. White , who dabbles in in-car electronics for a living, obviously/unfortunately was not willing to share how/where he got the memory dump, but having figured out the file-format of the dump file, I went ahead and wrote a tool to create a new file to insert custom logos into the binary file and provided this custom file to Mr.White to put back on a radio to try. However, since then no development has taken place, at least on my end, nor I believe on his end. A Sample of some custom logo's I made and dropped in (You may want to click on them to reload/replay them):

Irony of course is that figuring out the data was fairly easy for me (having done similar things years ago with e.g. the LithTech Game engine and writing a popular tool at the time called WinRez)  - but now figuring out how to get AT the data is the hard part. So at this point I'm on a little mini quest to see if I can figure out how to get at this data myself.

Hopefully this entry will someday have a nice part II/III etc with successful results - if not , then at least it will hopefully at least serve to show that if you have access to it the data can be deciphered (and possibly new images inserted)- I already wrote the specs to prove that ;).

Adventures in SW-Can/GMLan Land - Part II

After reading Brads' blog over on GTOSoft about converting a generic ELM327 device to SWCan I figured I'd give it a shot myself using a cheapy ELM327 clone and document everything ( in what turned out to be this ridiculously long Blog post), including all the stupid mistakes I'd undoubtedly would be making.


Step 1 - Getting the Device
So I figured I would try out the SW-Can conversion on one of the cheapest most common ELM327 clones available. A quick look on EBay turns up hundreds of these. Since I figured I would always have my device connected to a computer, and at this point did not care about having a mobile app to display info etc etc I decided I would go with the standard USB Version. These can be had for less than $20 USD.

Generic ELM327 Clone

 Most pictures on Ebay show this device coming with a mini-cd with drivers/software etc, but mine simply came with some instructions on where to download drivers (if needed - which they weren't) and get some free and/or trial software. Another interesting point is that ELM officially states their latest version is 1.4b, and there is NO version 1.5, however on Ebay people are selling version 1.5 units, which upon closer inspection apparently are more like official version 1.2. The one I purchased had a large 'version 1.4' in the image, but of course after hooking it up to my PC and getting the version string out it says: Version 1.5.. Ebay + clone made in China != truth in advertising!

I figured I would plug it in and see if it would at least work with the Hi-Speed CAN in my G8 (which it's supposed to), but surprise, surprise - it did not work! Well let's crack this thing open to see what the deal is.



Step 2 - Let's see what's inside
Looking at the device it's an integrated box/connector unit with a single USB cable coming out the back. I was hoping it wasn't a case that snaps closed with plastic tabs, but luckily after running my finger over the sticker I could feel where there were some screw holes to open it.

Sticker Removed, exposing the screw holes

Back Cover removed

It was nice to see that both the USB and OBD2 Connector plug into the PCB with a connector, which saves me from having to desolder a bunch of stuff. Obviously this is a generic board used for several models since there were a bunch of unused pads and other areas.

Both OBD2 and USB Plug into the board

Top of the PCB

Bottom of the PCB

 Looking at the board, I took an inventory of any large ICs - I found the following:

• PIC18F25K80 - MCU
  
• MCP2551 - Hi-Speed Can Transceiver
  
• FT232RL - USB Uart Chip
  

 Wait a minute! Weren't we supposed to find an ELM327 here? The ELM327 is a product of 'Elm Electronics', but if you look at the actual data-sheet of an ELM327 on page 74 you will see that it is basically listed as being 18F2480 chip. It's the firmware & command set that makes it an ELM327.
Here we have a 18F25K80, which obviously is a chip from the same family.
 

Location of the Can Transceiver

The Can Transceiver which we will be replacing is the MCP2551 and can be found on the bottom of this particular board. Just like Brad's protoboard, we will be soldering our protoboard to pads 1-4 , and then solder the SW-Can wire to Pin 1 on the actual OBD2 connector.

Pin 1 is not connected - this is where we will connect the SWCan line

Step 3 - Why won't this %$#!#& thing work right now?
This is an interesting side-note I wanted to at least mention. While I did not really care that it did not function on the Hi-Speed CAN Bus, I was curious at least as to why it would not work. After some digging I ran across a Fiat Community of all places where there is a long thread (28 pages currently) about these devices and reasons for them not working on a high speed CAN Bus.

It appears that these clones simply put a 120 Ohm resistor between the Can-H and Can-L Pins. However looking at the ELM327 Datasheet again on page 67 where the default schematic is listed you can see that instead of a single terminating resistor you need a different setup all together.

120 Ohm resistor between pin 6 &7 on the MCP2551? Why, surely you jest!

People have reported having success finding that 120 Ohm resistor and taking it off the board, or people have actually taken the time not only remove that resistor but also added R32/C8 & R33/C9 to the board. If yours isn't working check out the FAULTY ELM 327 INTERFACES DE-MYSTIFIED (READ HERE) link to see how to possibly fix it for your particular clone.


Step 4 - Getting the components & designing a new schematic
Now that I had my ELM327 device it was time to whip up a prototype board and get the components needed to do this. I obviously could see what Brad's components were: 2x Resistors, an Inductor, a Capacitor and the TH8055. I soon found out that the TH8055 is no longer produced, but in it's place there is now a TH8056. Ok , so we use the new part and keep the rest the same right? Not so fast....

I decided to compare the TH8055 datasheet to the TH8056 datasheet and found some interesting differences in their suggested schematics.

TH8055 Reference Schematic

TH8056 Reference Schematic

The main points of change seem to be:

1. The 220 pf Capacitor connecting the SWCAN line to ground, now is a 100pf value
2. A 1K resistor now runs parallel to the 47 uH inductor on the SWCan line
3. The Load resistor connecting pin 6 and 7 is now 6.4K instead of 9.1K (not used in Brad's design)
4. VBat (pin 5) now connects to CanH (pin 7) through a 100pF capacitor.
5. The Resistor connecting Pin 4 (RxD) to the 5V regulator is now 2.7k instead of 2.5k Ohm

Some of these changes may not be totally necessary and are more there for ESD protection etc, but I figured I would apply these changes to Brad's schematic and come up with a schematic for the TH8056 that 'should' work. Again - excuse the bad schematic drawing skills ;)

Next it was time to get the supporting parts to build this onto a little prototyping board. As I was searching Digi-Key (Mouser did not seem to carry the TH8056) I ran into a SMD Based protoboard called a 'surfboard' by a company called Capital Advanced. This particular board (the 9801) had a SOIC-8 layout which would fit the TH8056 just perfectly. I hadn't planned on using SMD components, but it was a perfect excuse to turn this into 'Adventures in SMD components' as well !

The Protoboard "Surfboard" 9801

Based on this I decided to order anywhere from 10-50 of each resistor/capacitor etc since a) They're super cheap and b) I figured with how tiny they are you never know if you're going to lose them and c) The fact my soldering skills are sub-par I figured I would probably need to build 5 boards at least before I had one that would be acceptable & functioning ! ;)



Step 5 - Building a Protoboard
Once I had all the parts I figured I'd try my hand at getting some of these small components on the board. I opted for 1206 size (which according to a lot of SMD fans is still 'large' - hilarious - most people brag online about how 'large' things are, but in EE forums people brag about the smallest components they can hand solder...LOL), because that is what the Surfboard was made for. Also I didn't really want to go smaller because this was my first time dealing with surface mount components. As you can see from the picture these things are TINY!

1206 size Resistor - This is a LARGE one??

The datasheet for the 9081 Surfboard has a nice black & white image of the pad layout so I decided to print a few of these on a sheet of paper together with the schematic so I could draw up a decent way of layout the board without having to redo it everything.

Don't mind the wrinkles - this piece of paper has been places!

This didn't really work out too well for revision 1 since I tried to cram 3 components (+ a wire) onto 1 mid length pad. I realized this wasn't going to work after getting them on there and it looked like this (check top right):

Hey look it's amateur hour! BOOOH You Suck!

Another problem I had was that as I was trying to solder the components they kept moving. Even with me soldering on 1 side first and then trying to do the other they kept sliding about. It really makes me want to try the 'toaster oven' soldering method if I keep working with these SMD components. I read up on a few things and some people (and even the SurfBoard site) mention sticking the components down first with 'something' first (tack, super glue etc).

For my 2nd try I figured I'd use some (NON-CONDUCTIVE! ;) ) superglue with a needle to get the components in place first - and THEN solder them. Just sticking them on with glue gave a much nicer & neat result

Tacking the components with a little drop of Superglue

Next up I had several connections I need to make using 'jumper wires', or at least connect adjacent pads. In my list Digi-Key Order I had actually included some 0 Ohm resistors since I figured that would be a clean way to make some of these connections. (probably not what die-hard electronics people would use so apologies for this blasphemy, but it works for me!) E.g. in the previous picture you can see 2 0-Ohm resistors near the bottom of the SOIC pads, and one connection the top right 'pin 8' to what will be the ground connection.

For other parts though it still seemed a bit tricky if not impossible to use these 0-Ohm resistors to connect some pads. For instance - looking at the far right in the previous picture you can see a resistors, inductor and capacitor , and they all needed to interconnect, but squeezing in two more 0-Ohm resistors would simply not be possible. Looking around my desk I found a paperclip which had some kind of serration pattern on it. It matched the distance of the pads quite well, so I straightened it out and cut off little segments and soldered these in place to connect the pads!

Ah Paperclip - you come to the rescue once again!

Now we're getting somewhere! Includes Paperclip pieces ;)

After soldering on all components, connecting pieces and wiring it was ready to connect this to the main board and the OBD2 Connector. As mentioned previously the SWCan line would go to Pin 1 on the OBD2 Plug, while the Rest (+5V,GND, CANTx and CANRx) would connect to the pads where the now removed MCP2551 chip had resided.

Everything all hooked up and ready to go!

Step 6 - The (smelly & smokey) results
It was a bit of a struggle to get everything back in the case, but I managed to route the wiring that wraps around the board along the side to make it fit.. The plain backside of the proto board faces down so there's no worried about shorting anything, but I stuck a piece of plastic in between anyway just in case. I'll probably shrinkwrap the whole board to avoid any kind of problems. (In fact I may make another board and try to clean up a few messy areas, use some better wiring etc). The housing actually closes again (though it's tight) so you are left with a stock looking unit that now does SWCAN... technically that is, if I haven't screwed anything up, and of course you need to kick it into the right mode to start talking to your car.

Ready to test!

Ok lets hook up the USB Port and see if we didn't blow anything up:

• Plug cable into PCB *check*
• Plug USB Cable into PC *check*
• Smell something burning *check* 
• See smoke coming from proto-pcb *check*
• Let expletives fly while yanking the cord out *check!*

WHAT THE?!?  ooookay.. so depending on how keen your eye is in the second to last picture above you may spot a stupid Pre-Electronics 101 mistake.. I was in rush to get the wiring done before going home for the day and unlike my schematic where +voltage is usually on top, and Ground on the bottom, on the actual PCB Board the GROUND was on the top right, and the +5 supply bottom right... Dumbass IDIOT me hooked up the wiring reverse and *poof* buh-bye TH8056..  and THAT boys & girls is why it's always best to get some spare parts! lol (of course I basically bought enough to build probably about 10 boards minus the TH8056s.. only got 2 of those - and now one ;) )

Step 7 - Try again!

Ok let's do this again....Besides hooking things up wrong, having to make another protoboard was a nice excuse for some more soldering practice and changing a few things I wasn't 100% happy with. For one the paperclip leads I made just didn't fit right. Instead now I snipped off the legs of a transistor I found 'somewhere' which worked much better. Also instead of rushing things and only tacking half my components down, I pre-placed EVERYTHING (instead of only half the components) with little dots of glue which gave a much neater result. Again I used the 0-Ohm resistors as jumps where I could to clean up the connectors and make it easier to connect the wiring to the board (using the longer pads)

Board #3 - super neat , let's hope I don't ruin it soldering!

Not Half Bad...if I may say so myself

Oh hey look - Correct polarity XD

A quick plug in to the PC showed the power on sequence on the LEDS without any dramatic visual or smelly effects. Excellent! Next was trying to connect it to the car and getting it to communicate.
I used realterm for now and set the connection rate to 38400. Based on comments I know this is too slow and will cause a buffer overflow unless you filter for a specific header, but for an initial test I didn't care. The ELM327 (& clones) doesn't officially support the 33.3kbps canbus, but it does support a 'user-mode' where you can force these settings. Based on Brad's findings he uses the following commands to initiate communication:

• AT WS - Quick Reset of device
• AT L1 - Turn on LineFeeds after each line
• AT H1 - Show Complete message including headers
• AT PP 2C SV 40 - Set Programmable Parameter '2C' to value 0x40
• AT PP 2C ON - Turn Programmable Parameter '2C' ON
• AT PP 2D SV 0F - Set Programmable Parameter '2D' to value 0x0F
• AT PP 2D ON - Turn Programmable Parameter '2D' ON
• AT PP 2A OFF - Turn Programmable Parameters '2A' OFF
• AT WS - Quick Reset to restart with the above settings
• AT SP B - use 'User Protocol B'
• AT R0 - Do not wait for responses when sending commands
• AT CAF 0 - Turn off CAN AutoFormatting
• AT L1 - Turn on LineFeeds after each line
• AT H1 - Show Complete message including headers
• ATMA - Enter Bus Monitoring mode

A closer look at the programmable parameters in the ELM327 datasheet we can see exactly what is being set:
'2A' - Can Error Checking - Turned Off
'2C' - Protocol B Options : 0x40 = 1000000 binary, so bit 6 is 'data length' and the ELM327 sheet shows a value of '1' means we are dealing with a variable data length
'2D' - Protocol B Baud Rate: 0x0F ; The baud rate is calculated as 500/value = target kbps. So in this case we have 500/15 = 33.3333 kbps

This time when I hooked up the device to the OBD Port and followed the above steps.. SUCCESS! Glorious data streamed across my terminal screen, until of course the expected buffer error occurred. However that's an easy fix with some baud rate tweaks on the computer side etc.

So if you're interested in making your own SWCan device out of a generic clone for less than $10 it's definitely do-able! I may actually make a few more protoboards, or even a few whole devices if anyone's interested in buying them - especially since I've got spare-parts a plenty!

Now the interesting part comes with either talking to the car, or figuring out what certain button presses are. If you are interested to see what people have already figured out about this , check out the carmodder site here where a bunch of smart people hang out ;)

Adventures in SW-Can/GMLan Land - Part I

The Pontiac G8 (and all it's variants) uses Hi-Speed CAN and 'Single-Wire Can' also known as SWCAN for it's internal communications with the different sensors, computers etc. GM has it's own message structure built on top of regular CAN, called 'GMLan. And while the Hi-Speed line is used for crucial information such as engine controls etc (and used for ECM/TCM Reprogramming etc), the SWCan line is used for slower speeds / more 'informative' data like simple status messages, certain button presses like turn the A/C up or down. This also means that for a hobbyist the SWCan line is the much more interesting line to be looking at.

Unfortunately most OBDII devices only support Hi-Speed Can, and don't support SW-Can. You can buy specialized devices, but these tend to be expensive: Ranging from $200-500 for a plugin device. Part of the fun when people mod their cars or tinker with electronics is of course the DIY Aspect so there has to be a way to get around this.

Brad over at 'GTOSoft' is obviously a skilled electronic engineer and he managed to take a typical ELM327 based BlueTooth OBDII device, and modify it to be a SW-Can device instead. You can read his Blog entry here: How to Build a Single-Wire Can Adapter. I noticed based on the comments that it wasn't totally clear what exactly he did, so I figured I'd try to re-create this, but by using a USB-Version of a typical ELM327 based device since for what I wanted to do I would be connected to my laptop anyway. Also I figured I would describe the actual process. It's nice to know to solder Component A to Wire B, but it's better to know WHY you're doing it.


First, let's see exactly what Brad did - The Typical ELM327 Device is basically exactly made per the datasheet where on page 67-69 you can see the standard schematic, part list and optional USB connection (or in his case, bluetooth). Obviously the section we are interested in is the Hi-Speed Can transceiver, which is replaced with a Single-Wire can transceiver. Cleaning up the schematic to only show the Can Section we find the following standard schematic (which may or may not be 100% accurate depending on which device/clone version you purchase):

Typical Can-Bus implementation for an ELM327 based device

The MCP2551 is a Hi-Speed Can Transceiver which connects the Can-Bus (Can-L & Can-H) to the ELM327 Chip on pin 24 & pin 23, which are it's Can RX and Can TX respectively. The Datasheet for it shows the following pin-out:

Looking at the pin-outs and the ELM327 schematic you can see how they match up. Of course the point is to get rid of this chip and switch to a Single-Wire Can chip.
 
While there are several chips available as Single-Wire Can Transceivers, Brad from GTOSoft devised a prototype board with a Melexis TH8055 Single-Wire Can transceiver to take the place of the MCP2551, so let's look at the a typical TH8055 implementation in the DataSheet. (Since the chip has reached it's end-of-life and is now replaced by the TH8056, the datasheet does no longer seem to be on the Melexis site. Luckily there are tons of 'datasheet' sites available where you can find almost anything!)

Obviously the pin-out for the TH8055 is different than the MCP2551. Pin 1,4 and 7 in theory seem to be in the same location, but this really does not mean anything to use, since the supporting circuitry between the two is vastly different . This is for instance how a typical TH8055 schematic would look

Now obviously there are bunch of components on here, but looking at the pictures that Brad put up of his proto-board you'll notice he has 4 components in addition to the TH8055 chip.

GTOSoft SW-Can ProtoBoard

There are 2 resistors, a Capacitor and the 'dark' looking resistor is actually an inductor. While Brad's post was a little thin on actual details, he was kind enough to post pictures from multiple angles, which allowed me to reconstruct his board as quick schematic, which if I did everything right looks like this (Excuse my crappy schematic skills) - Note that I drew it to mimic his actual board layout and not a 'generic' schematic, so some things may look a little weird

Comparing this schematic to the datasheet version, we see, starting at the SW Can Input:
L1 - the 47uH Inducator inline with the SW-Can line to Pin 7
C1 - the 220pf Capacitor (yes it's 'after' the inductor in this board) connected to ground
Pin8 - Connected to Ground
TXD - going to Can Controller / ELM327
RXD - going to Can Controller / ELM327
Pin5 - Getting +5v / VBatt

Notice though that in the original schematic Pin5/VBatt is obviously in the 12V area, while here we're dealing with 5V. Apparently the TH8055/TH8056 has a wide range of operating voltages and according to the datasheet DOES function with 5V (though some things that we're not dealing with are affected)

So far so good, but at this point the design deviates a little from the reference schematic.
a) R1 - 2.1k Resistor between Pin5 and Pin4. Looking at the TH8055 schematic we see that Pin5 normally gets VBat and Pin 4 gets connected to a 5v regulator through a 2.5k resistor. Since we're piggybacking of another board, the way I understand 'R1' is to basically mimic this behavior by still connecting Pin 4 (TXD) to a 5V source. But since we do not have an extra voltage regulator we connect it to the other 5V source at hand (which most likely already came out of a regulator).  The value of R1 is a little lower than the original schematic, but is still 'close enough' where it would not cause any issues.

b) pin 6 is seemingly left unconnected , unlike the schematic where it's tied to Pin7 with a resistor- apparently this was not needed for this project

c) The more interesting thing is Pin2 and Pin3. These are defined as 'Mode 0' and 'Mode 1' in the datasheet. According to the TH8055 schematic these normally connect to the Can Controller and set the mode of the Can Transceiver to either Sleep Mode, High Speed Mode, Wake up, or Normal Mode. Now since the ELM327 does not have these pins (ELM329 does!)  By tying Pin 2 and Pin 3 together and then to the 5v power through a 10K resistor Brad devised a way to keep these pins both 'high' which means the transceiver would work in 'Normal' mode, which is exactly what we want. Simple, but effective!

This leaves us with a board which has 5 wires connected being:
Pin 1- TXD
Pin 4- RXD
Pin 5- PWR (+5V)
Pin 8- GND
Pin 7- SW-Can

To install the board you would simply solder the wires to the footprint of the removed MCP2551 chip, which looking at it's pinout would be:
Pin 1 - TXD
Pin 2 - GND
Pin 3 - PWR
Pin 4 - RXD


Lastly Pin 7 - the wire with the inductor connection, will simply connect directly to Pin 1 on the actual OBDII connector , which usually is not connected to anything.

Here's a picture of Brad's board connected in that exact way, with the green wire going to the back of the board/blue OBDII plug is the SWCan connection.

Next up - Let's do this conversion on a cheap Ebay ELM327 based device!